ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

News

17 stories in the last 3d

Sortlatesthotimportance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllVulnerability 136Advisory 126AI industry 89AI research 75AI safety & security 75Exploit / PoC 75Research 69Industry 58Malware 39Data breach 39Tools 37Policy & legal 30Threat actor 29Phishing & fraud 17
SeverityAllcritical 41high 192medium 190low 54info 460

Oracle Critical Security Update – 673 Vulnerabilities Patched Across Product Families

Oracle's September 2026 Critical Patch Update ships 673 patches across 17 product families, including 100+ critical and 240+ remotely exploitable flaws.

Oracle's September 2026 Critical Security Patch Update ships 673 patches covering 672 unique CVEs, with more than 130 additional CVEs resolved through bundled fixes, pushing the effective total past 800. Over 100 flaws are critical severity and more than 240 are remotely exploitable without authentication. Oracle E-Business Suite received 159 fixes, Fusion Middleware 153 (78 unauthenticated and network-exploitable), and Hyperion 102. No in-the-wild exploitation of these specific flaws is reported, but Oracle cites CISA's earlier 72-hour remediation order for actively exploited CVE-2026-21962 (CVSS 10.0).

Cyber Security Newsupdated · 36m agofirst · 7h agoAdvisory 3 sourcesCVE-2026-21962

Cisco Identity Services Engine Hardening Release: September 2026

Cisco ISE hardening release fixes multiple internally discovered vulnerabilities, including an authentication bypass known to be actively exploited.

Cisco released September 2026 hardening updates for Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) following a comprehensive internal security review that uncovered multiple vulnerabilities. One of the flaws, an ISE authentication bypass, is known to be actively exploited. Cisco grouped the issues by underlying vulnerability to help customers prioritize patching and streamline disclosure.

Cisco Security Advisories · 4h agoAdvisory in the wild 15 sources

Cisco Secure Firewall Adaptive Security Appliance, Secure Firewall Threat Defense, and Secure Firewall Management Center Software Hardening Release: September 2026

Cisco's September 2026 firewall hardening release fixes internally found ASA, FTD, and FMC flaws, two of which are actively exploited.

Cisco released September 2026 hardening updates for Secure Firewall ASA, FTD, and FMC software addressing multiple vulnerabilities discovered during a comprehensive internal security review. Two of the vulnerabilities are known to be actively exploited, including a Cisco Secure Firewall Management Center static credential vulnerability. Details are provided in separate linked advisories.

Cisco Security Advisories · 4h agoAdvisory in the wild 6 sources

Oracle Critical Security Patch Update, September 2026 Review

Oracle's September 2026 Critical Patch Update fixes 673 vulnerabilities, including 104 critical, with many remotely exploitable in E-Business Suite and Fusion Middleware.

Oracle released 673 security patches in its September 2026 Critical Patch Update: 104 rated critical, 503 high, and 59 medium. Oracle E-Business Suite received the most patches (159, 24% of total), with 19 exploitable without credentials including CVE-2026-83327, CVE-2026-83452, and CVE-2026-83462 at CVSS 9.8. Fusion Middleware received 153 patches with 78 remotely exploitable without authentication, and 41 patches address third-party open-source component flaws. Qualys published detection QIDs for vulnerable assets.

Qualys ThreatPROTECT · 5h agoAdvisoryCVE-2026-83154CVE-2026-83196CVE-2026-83197+10 CVEs

Cisco security advisory (AV26-921)

Canadian Cyber Centre warns actively exploited Cisco Secure Email Gateway SQL injection CVE-2026-76461 was added to CISA's KEV database.

The Canadian Centre for Cyber Security advisory AV26-921 (September 14, 2026) covers a SQL injection vulnerability in Cisco Secure Email Gateway (AsyncOS) and Secure Email and Web Manager. Affected versions include AsyncOS/Secure Email Gateway prior to 15.5.5-014, 16.0.4-302, and 16.5.0-780, and Secure Email and Web Manager prior to 15.5.5-006 and 16.5.0-429. Cisco stated CVE-2026-76461 is being actively exploited, and CISA added it to the Known Exploited Vulnerabilities database the same day. Users and administrators are urged to apply updates as they become available.

Canadian Centre for Cyber Securityupdated · 6h agofirst · 2d agoAdvisory in the wild 17 sourcesCVE-2026-76461

Apple Releases iOS 27 Security Update to Fix Over 120 Vulnerabilities

Apple released iOS 27 and iPadOS 27 patching roughly 126 vulnerabilities across kernel, WebKit, sandboxing, and authentication components; no active exploitation reported.

Apple released iOS 27 and iPadOS 27 on September 14, 2026, fixing approximately 126 vulnerabilities across more than 90 components, including the kernel, WebKit, AppleKeyStore, Sandbox, and TCC. Flaws include memory corruption, information disclosure, denial-of-service, logic errors, sandbox escapes enabling root privileges, and a Bluetooth issue permitting remote code execution in specific circumstances. Apple also shipped iOS 26.7 and iPadOS 26.7 with over 80 fixes for users delaying the major upgrade, including 75 vulnerabilities shared with iOS 27. No vulnerabilities were reported as actively exploited at release time.

GBHackers · 14h agoAdvisory

Cisco Integrated Management Controller Argument Injection Vulnerabilities

Cisco patched multiple argument-injection vulnerabilities in Cisco IMC's web management interface allowing authenticated attackers root command execution.

Cisco published an advisory covering multiple argument injection vulnerabilities in the web-based management interface of Cisco Integrated Management Controller (IMC). An authenticated, remote attacker could exploit them to execute arbitrary commands on the underlying operating system and elevate privileges to root. Cisco released software updates and states there are no workarounds; the advisory carries a High Security Impact Rating.

Cisco Security Advisories · 23h agoAdvisory

IBM security advisory (AV26-922)

Canadian Cyber Centre relays IBM advisory for Langflow, MQ, and Sterling File Gateway flaws including MQ remote code execution (CVE-2026-13293).

Canadian Cyber Centre advisory AV26-922 relays IBM fixes for Langflow OSS (versions through 1.11.5 across release lines), IBM MQ (10.0.0.0 and 9.x LTS/CD through 9.4.5.1), and Sterling File Gateway (through 6.2.2.1). CVE-2026-13293 is a remote code execution flaw in IBM MQ Java messaging caused by an incomplete security scanner blocklist enabling network-based code execution. CVE-2026-19290 is an improper access control vulnerability in IBM Sterling File Gateway. Administrators are urged to review and apply the necessary updates.

Canadian Centre for Cyber Security · 1d agoAdvisoryCVE-2026-13293CVE-2026-19290

USN-8763-1: kitty vulnerabilities

Ubuntu patches three kitty terminal flaws including remote command execution via crafted escape sequences.

Ubuntu Security Notice USN-8763-1 fixes multiple vulnerabilities in the kitty terminal emulator. CVE-2026-42850 allows a remote attacker to execute arbitrary commands via improperly escaped error messages triggered by crafted terminal escape sequences. CVE-2026-42851 enables arbitrary code execution with the user's privileges through mishandled remote edit requests in terminal output. CVE-2026-54055 lets a local attacker overwrite arbitrary files via destination paths in kitty's file transmission protocol.

Ubuntu Security Notices · 1d agoAdvisoryCVE-2026-42850CVE-2026-42851CVE-2026-54055

Siemens Reyrolle 7SR5

CISA advisory covers 14 vulnerabilities, CVSS 9.8, in Siemens Reyrolle 7SR5 energy-sector protection relays before V2.70.

CISA advisory ICSA-26-258-05 covers 14 vulnerabilities in Siemens Reyrolle 7SR5 protection relays before V2.70, used in the energy sector worldwide, with aggregate CVSS v3 of 9.8. Flaws include Cesanta Mongoose web server issues (CVE-2024-42384 through CVE-2024-42392) and new bugs such as web-interface session-ID exposure enabling authentication bypass (CVE-2026-62645, CVSS 9.8), predictable session tokens (CVE-2026-62646, CVE-2026-62647), and pre-auth out-of-bounds writes (CVE-2026-62648). Siemens has released V2.70 and recommends updating to the latest version.

CISA Advisories · 1d agoAdvisoryCVE-2024-42384CVE-2024-42385CVE-2024-42386+11 CVEs

CareCam CM2507

CISA advisory: seven flaws in CareCam CM2507 IP cameras enable unauthenticated live video access, privileged ONVIF control, credential recovery, and code execution.

CISA advisory ICSA-26-258-08 discloses seven vulnerabilities in CareCam HMT.CM2507 IP cameras running firmware v251211.1507. Issues include missing authentication for network video streaming (CVE-2026-88259, CVSS 3.1 7.5), an empty password on a privileged ONVIF account (CVE-2026-84398), weak legacy hashing of the root password (CVE-2026-85497, CVSS 4.0 9.3 critical), and cleartext storage of Wi-Fi credentials (CVE-2026-81321). Physical-access flaws allow arbitrary code execution from scripts on removable media (CVE-2026-81305) and unauthenticated bootloader access (CVE-2026-85478). The cameras are deployed worldwide in commercial facilities.

CISA Advisories · 1d agoAdvisoryCVE-2026-88259CVE-2026-84398CVE-2026-84400+4 CVEs

Wärtsilä FOS-Onboard

CISA advisory: two hardcoded cryptographic key flaws in Wärtsilä FOS-Onboard 5.07.0923.01 (CVSS 9.0/9.1) could allow unauthorized updates, code execution, and credential theft.

CISA advisory ICSA-26-258-02 discloses CVE-2026-78225 (CVSS 3.1 9.0 critical), a hardcoded cryptographic server key in the deployer-ng Update Controller of Wärtsilä FOS-Onboard 5.07.0923.01. CVE-2026-81855 (CVSS 3.1 9.1 critical) is a hardcoded client authentication key in the robot testing framework component. Successful exploitation could let an attacker deliver unauthorized updates, execute code, or extract credentials to impersonate a privileged client. The product is deployed worldwide in transportation systems critical infrastructure; Cydome Security reported the flaws and CISA states no known public exploitation exists.

CISA Advisories · 1d agoAdvisoryCVE-2026-78225CVE-2026-81855

Digital Watchdog VMAX DVR and NVR Product Lineups

CISA advisory details six flaws, aggregate CVSS 9.6, giving attackers full control of Digital Watchdog VMAX DVR/NVR surveillance devices.

CISA advisory ICSA-26-258-01 discloses six vulnerabilities affecting all versions of Digital Watchdog VMAX A1 G4 DVRs, VMAX IP G4 NVRs, VMAX A1 PLUS, VA1G4, and VG4 recorders, with aggregate CVSS v3 of 9.6. Flaws include an authentication bypass leaking plaintext admin credentials (CVE-2026-68953), hard-coded credentials enabling root FTP access (CVE-2026-66890, CVE-2026-68950), root command execution (CVE-2026-68070), missing authorization on state-changing CGIs (CVE-2026-66887), and predictable session tokens (CVE-2026-66372). Successful exploitation grants full administrative control, live and recorded surveillance access, and a network pivot point. Products are deployed worldwide across commercial facilities, government, healthcare, and transportation sectors.

CISA Advisories · 1d agoAdvisoryCVE-2026-68953CVE-2026-66890CVE-2026-68070+3 CVEs

mySCADA myPRO Manager

CISA advisory reveals unauthenticated privileged API access and arbitrary SMS sending in mySCADA myPRO Manager <=2.1, CVSS 9.8.

CISA advisory ICSA-26-258-03 discloses two vulnerabilities in mySCADA myPRO Manager <=2.1 with aggregate CVSS v3 of 9.8. CVE-2026-73807 (CVSS 9.8) lets unauthenticated network attackers access privileged management functions via the command API, while CVE-2026-82567 exposes an unauthenticated HTTP endpoint that sends arbitrary SMS messages through a connected GSM modem. Deployments span critical manufacturing, energy, food and agriculture, transportation, and water and wastewater sectors. CISA states no known public exploitation has been reported at this time.

CISA Advisories · 1d agoAdvisoryCVE-2026-73807CVE-2026-82567

Siemens Mendix SAML

Siemens Mendix SAML module fails signature validation, allowing unauthenticated account hijacking in specific SSO configurations (CVE-2026-80465).

CISA republished Siemens advisory SSA-887643 for CVE-2026-80465 (CVSS 8.7) in the Mendix SAML module, affecting Mendix 10/11-compatible versions before 4.2.3 and Mendix 9.24-compatible versions before 3.6.27. The module improperly validates SAML response signatures (CWE-347), letting unauthenticated remote attackers hijack an account in specific SSO configurations. Mendix has released fixed versions and recommends updating.

CISA Advisories · 1d agoAdvisoryCVE-2026-80465

USN-8753-1: libinput vulnerability

Ubuntu patches libinput flaw letting local attackers inject udev properties and execute arbitrary code as root.

USN-8753-1 fixes a libinput vulnerability where device properties are not properly escaped. A local attacker could inject arbitrary udev properties and execute arbitrary code as root, a full local privilege escalation on affected Linux desktop systems. Ubuntu shipped updated packages.

Ubuntu Security Notices · 2d agoAdvisory

ZDI-26-684: Linux Kernel KSMBD Query Directory Request Race Condition Remote Code Execution Vulnerability

ZDI discloses CVE-2026-64397, a CVSS 9.0 unauthenticated remote code execution race condition in Linux Kernel KSMBD.

ZDI-26-684 describes a race condition in the Linux Kernel KSMBD subsystem's Query Directory Request handling that allows unauthenticated remote attackers to execute arbitrary code. Only systems with KSMBD enabled are vulnerable. ZDI assigned a CVSS rating of 9.0 and CVE-2026-64397.

ZDI Published Advisories · 2d agoAdvisoryCVE-2026-64397